November 2021 - openSUSE Security Announce

openSUSE-SU-2021:1443-1: moderate: Security update for salt
by opensuse-security＠opensuse.org 02 Nov '21

02 Nov '21

openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1443-1 Rating: moderate References: #1190265 Cross-References: CVE-2021-21996 CVSS scores: CVE-2021-21996 (SUSE): 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for salt fixes the following issues: - Support querying for JSON data in external sql pillar. - Exclude the full path of a download URL to prevent injection of malicious code. (bsc#1190265, CVE-2021-21996) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1443=1 Package List: - openSUSE Leap 15.2 (x86_64): python3-salt-3002.2-lp152.3.45.1 salt-3002.2-lp152.3.45.1 salt-api-3002.2-lp152.3.45.1 salt-cloud-3002.2-lp152.3.45.1 salt-doc-3002.2-lp152.3.45.1 salt-master-3002.2-lp152.3.45.1 salt-minion-3002.2-lp152.3.45.1 salt-proxy-3002.2-lp152.3.45.1 salt-ssh-3002.2-lp152.3.45.1 salt-standalone-formulas-configuration-3002.2-lp152.3.45.1 salt-syndic-3002.2-lp152.3.45.1 salt-transactional-update-3002.2-lp152.3.45.1 - openSUSE Leap 15.2 (noarch): salt-bash-completion-3002.2-lp152.3.45.1 salt-fish-completion-3002.2-lp152.3.45.1 salt-zsh-completion-3002.2-lp152.3.45.1 References: https://www.suse.com/security/cve/CVE-2021-21996.html https://bugzilla.suse.com/1190265

1 0

openSUSE-SU-2021:1436-1: important: Security update for mailman
by opensuse-security＠opensuse.org 02 Nov '21

02 Nov '21

openSUSE Security Update: Security update for mailman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1436-1 Rating: important References: #1047218 #1191959 #1191960 Cross-References: CVE-2021-42096 CVE-2021-42097 CVSS scores: CVE-2021-42096 (SUSE): 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-42097 (SUSE): 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for mailman fixes the following issues: Update to 2.1.35 to fix 2 security issues: - A potential for for a list member to carry out an off-line brute force attack to obtain the list admin password has been reported by Andre Protas, Richard Cloke and Andy Nuttall of Apple. This is fixed. CVE-2021-42096 (boo#1191959, LP:#1947639) - A CSRF attack via the user options page could allow takeover of a users account. This is fixed. CVE-2021-42097 (boo#1191960, LP:#1947640) - make package build reproducible (boo#1047218) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1436=1 Package List: - openSUSE Leap 15.2 (x86_64): mailman-2.1.35-lp152.7.6.1 mailman-debuginfo-2.1.35-lp152.7.6.1 mailman-debugsource-2.1.35-lp152.7.6.1 References: https://www.suse.com/security/cve/CVE-2021-42096.html https://www.suse.com/security/cve/CVE-2021-42097.html https://bugzilla.suse.com/1047218 https://bugzilla.suse.com/1191959 https://bugzilla.suse.com/1191960

1 0

openSUSE-SU-2021:1434-1: important: Security update for opera
by opensuse-security＠opensuse.org 01 Nov '21

01 Nov '21

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1434-1 Rating: important References: Cross-References: CVE-2021-37974 CVE-2021-37975 CVE-2021-37976 CVE-2021-37977 CVE-2021-37978 CVE-2021-37979 CVE-2021-37980 Affected Products: openSUSE Leap 15.3:NonFree ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for opera fixes the following issues: Opera was updated to version 80.0.4170.63 - CHR-8612 Update chromium on desktop-stable-94-4170 to 94.0.4606.81 - DNA-95434 Crash at opera::ThemesService::UpdateCurrentTheme() - The update to chromium 94.0.4606.81 fixes following issues: CVE-2021-37977, CVE-2021-37978, CVE-2021-37979, CVE-2021-37980 Opera was updated to version 80.0.4170.40 - CHR-8598 Update chromium on desktop-stable-94-4170 to 94.0.4606.71 - DNA-95221 Emoji button stuck in address bar - DNA-95325 Make y.at navigations to be reported with page_views events - DNA-95327 Add ��Emojis�� context menu option in address bar field - DNA-95339 Add YAT emoji url suggestion to search�� dialog - DNA-95416 Remove emoji button from address bar - DNA-95439 Enable #yat-emoji-addresses on developer stream - DNA-95441 [Mac big sur] Emoji are not shown in address bar url - DNA-95514 Crash at resource_coordinator::TabLifecycleUnitSource ::TabLifecycleUnit::OnLifecycleUnitStateChanged(mojom:: LifecycleUnitState, mojom::LifecycleUnitStateChangeReason) - DNA-95746 Enable #reader-mode everywhere - DNA-95865 Numbers are recognized as emojis - DNA-95866 Change Yat text in selection popup - DNA-95867 Show that buttons are clickable in selection popup - The update to chromium 94.0.4606.71 fixes following issues: CVE-2021-37974, CVE-2021-37975, CVE-2021-37976 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3:NonFree: zypper in -t patch openSUSE-2021-1434=1 Package List: - openSUSE Leap 15.3:NonFree (x86_64): opera-80.0.4170.63-lp153.2.27.1 References: https://www.suse.com/security/cve/CVE-2021-37974.html https://www.suse.com/security/cve/CVE-2021-37975.html https://www.suse.com/security/cve/CVE-2021-37976.html https://www.suse.com/security/cve/CVE-2021-37977.html https://www.suse.com/security/cve/CVE-2021-37978.html https://www.suse.com/security/cve/CVE-2021-37979.html https://www.suse.com/security/cve/CVE-2021-37980.html

1 0

openSUSE-SU-2021:1433-1: important: Security update for opera
by opensuse-security＠opensuse.org 01 Nov '21

01 Nov '21

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1433-1 Rating: important References: Cross-References: CVE-2021-37974 CVE-2021-37975 CVE-2021-37976 CVE-2021-37977 CVE-2021-37978 CVE-2021-37979 CVE-2021-37980 Affected Products: openSUSE Leap 15.2:NonFree ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for opera fixes the following issues: Opera was updated to version 80.0.4170.63 - CHR-8612 Update chromium on desktop-stable-94-4170 to 94.0.4606.81 - DNA-95434 Crash at opera::ThemesService::UpdateCurrentTheme() - The update to chromium 94.0.4606.81 fixes following issues: CVE-2021-37977, CVE-2021-37978, CVE-2021-37979, CVE-2021-37980 Opera was updated to version 80.0.4170.40 - CHR-8598 Update chromium on desktop-stable-94-4170 to 94.0.4606.71 - DNA-95221 Emoji button stuck in address bar - DNA-95325 Make y.at navigations to be reported with page_views events - DNA-95327 Add ��Emojis�� context menu option in address bar field - DNA-95339 Add YAT emoji url suggestion to search�� dialog - DNA-95416 Remove emoji button from address bar - DNA-95439 Enable #yat-emoji-addresses on developer stream - DNA-95441 [Mac big sur] Emoji are not shown in address bar url - DNA-95514 Crash at resource_coordinator::TabLifecycleUnitSource ::TabLifecycleUnit::OnLifecycleUnitStateChanged(mojom:: LifecycleUnitState, mojom::LifecycleUnitStateChangeReason) - DNA-95746 Enable #reader-mode everywhere - DNA-95865 Numbers are recognized as emojis - DNA-95866 Change Yat text in selection popup - DNA-95867 Show that buttons are clickable in selection popup - The update to chromium 94.0.4606.71 fixes following issues: CVE-2021-37974, CVE-2021-37975, CVE-2021-37976 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2021-1433=1 Package List: - openSUSE Leap 15.2:NonFree (x86_64): opera-80.0.4170.63-lp152.2.73.1 References: https://www.suse.com/security/cve/CVE-2021-37974.html https://www.suse.com/security/cve/CVE-2021-37975.html https://www.suse.com/security/cve/CVE-2021-37976.html https://www.suse.com/security/cve/CVE-2021-37977.html https://www.suse.com/security/cve/CVE-2021-37978.html https://www.suse.com/security/cve/CVE-2021-37979.html https://www.suse.com/security/cve/CVE-2021-37980.html

1 0